CVE-2026-78435

LowCVSS 3.8/10Last modified Oct 12, 2026

Description

A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesk/SettingsController.php of the component Logo Handler. Such manipulation of the argument data1 leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 3.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Aug 24, 2026
Last modified: Oct 12, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-784377.3Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from anoth CVE-2026-784387.2The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via LazyLoad Background Mutator in CVE-2026-784398.8Stack-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.CVE-2026-78446.3A vulnerability was detected in chatchat-space Langchain-Chatchat up to 0.3.1.3. This vulnerability affects the function files/list_files/re CVE-2026-784416.5Out-of-bounds read in Windows OLE DB allows an unauthorized attacker to disclose information over a network.CVE-2026-784428.8Heap-based buffer overflow in Windows OLE DB allows an unauthorized attacker to execute code over a network.CVE-2026-784448.1Untrusted pointer dereference in Windows Failover Cluster allows an unauthorized attacker to execute code over a network.CVE-2026-784459.8Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to execute code over a network.CVE-2026-784467.5Use after free in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network.CVE-2026-784477.8Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.CVE-2026-784487.8Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.CVE-2026-784498.1Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over a network.